Amendments to the Claims 
Please cancel claim 13 and amend claims 24, 36, and 44 as follows: 
1.-23. (Cancelled) 

24. (Currently Amended) A user interface for representing an expression, comprising: 

a graphical representation of a tree that represents the expression, containing: 
a root node that includes a first operator of the expression; 

a plurality of internal nodes that include a plurality of operators of the expression; 
and 

a plurality of leaf nodes that include a plurality of operands of the expression; 
and , additionally, 

a plurality of symbols, adjacent to the plurality of operands in the tree, the plurality of 
symbols and the plurality of operands representing the expression in infix 
notation. 

25. (Previously Presented) The user interface of claim 24, wherein the expression comprises a 
Boolean expression. 

26. (Previously Presented) The user interface of claim 25, wherein the Boolean expression 
comprises a rule in a computer network security system. 

27. (Previously Presented) The user interface of claim 24, wherein a first portion of the user 
interface includes the plurality of operators, and wherein a second portion of the user interface 
includes the plurality of operands and the plurality of symbols, and wherein the first portion and 
the second portion do not overlap. 

28. (Previously Presented) The user interface of claim 27, wherein the plurality of symbols 
includes an open parenthesis that indicates an order of operations. 
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29. (Previously Presented) The user interface of claim 28, wherein the open parenthesis is 
located in the second portion of the user interface adjacent to an operator. 

30. (Previously Presented) The user interface of claim 27, wherein the plurality of symbols 
includes an infix operator. 

31. (Previously Presented) The user interface of claim 30, wherein the infix operator is located in 
the second portion of the user interface adjacent to an operand. 

32. (Previously Presented) The user interface of claim 24, wherein an operator of the plurality of 
operators is displayed symbolically. 

33. (Previously Presented) The user interface of claim 24, wherein an operator of the plurality of 
operators is displayed textually. 

34. (Previously Presented) The user interface of claim 24, wherein the plurality of operators 
includes a logical operator. 

35. (Previously Presented) The user interface of claim 24, wherein an operand of the plurality of 
operands includes an expression that includes a comparative operator. 

36. (Currently Amended) A computer-implemented method for displaying an expression, 
comprising: 

displaying a graphical representation of a tree that represents the expression, containing: 
a root node that includes a first operator of the expression; 

a plurality of internal nodes that include a plurality of operators of the expression; 
and 

a plurality of leaf nodes that include a plurality of operands of the expression; 
and , additionally. 
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displaying a plurality of symbols, adjacent to the plurality of operands in the tree, the 

plurality of symbols and the plurality of operands representing the expression in 
infix notation. 

37. (Previously Presented) The method of claim 36, further comprising: 

receiving data indicating a change to the first portion of the user interface; and 
updating the second portion of the user interface based on the received data. 

38. (Previously Presented) The method of claim 37, wherein the change to the first portion 
includes one of an insertion of an operator and a deletion of an operator. 

39. (Previously Presented) The method of claim 37, wherein updating the second portion of the 
user interface includes changing a symbol. 

40. (Previously Presented) The method of claim 36, further comprising: 

receiving data indicating a change to the second portion of the user interface; and 
updating the first portion of the user interface based on the received data. 

41. (Previously Presented) The method of claim 40, wherein the change to the second portion 
includes one of an insertion of a parenthesis and a deletion of a parenthesis. 

42. (Previously Presented) The method of claim 40, wherein updating the first portion of the user 
interface includes changing the graphical representation of the tree. 

43. (Previously Presented) The method of claim 36, further comprising displaying an expansion 
box, associated with an operator, configured to toggle between showing or hiding operands of 
the associated operator. 

44. (Currently Amended) A network security system, comprising: 

a plurality of agents to collect security events from a plurality of network security 
devices; 
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a manager including a rules engine to correlate the collected security events according to 
a set of rules; and 

a console interface to edit a rule from the set of rules using a user interface, the user 
interface comprising: 

a graphical representation of a tree that represents the expression, containing: 
a root node that includes a first operator of the expression; 
a plurality of internal nodes that include a plurality of operators of the 
expression; and 

a plurality of leaf nodes that include a plurality of operands of the 
expression; and , additionally, 
a plurality of symbols, adjacent to the plurality of operands in the tree, the 
plurality of symbols and the plurality of operands representing the 
expression in infix notation. 
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